Cloudflare announced on June 16 that its DMARC management tool has entered GA (General Availability) and is now free for all Cloudflare customers, with no additional configuration or cost required. This GA release brings three core upgrades: First, a redesigned reporting experience presents the pass/warn/fail status of all four email authentication protocols — DMARC, SPF, DKIM, and BIMI — in a unified view, along with actionable remediation advice explained in plain, non-RFC terminology. Second, each report can now be drilled down to the specific IP address of the sending source, with a direct link to Cloudflare’s threat intelligence Investigate tab to view the IP’s reputation data, geographic location, ASN information, and known malicious activity associations. Third, a new SPF query audit feature provides a visual trace of the cumulative count for each DNS query in an SPF record, helping users identify when they exceed the 10-lookup hard limit defined in RFC 7208 — exceeding this limit causes SPF checks to return a permerror and emails to be rejected outright. To enable it, the domain’s DNS must be hosted on Cloudflare; then turn it on under Dashboard > Email > DMARC Management.
Cloudflare noted that over the past two years, Google, Microsoft, and Yahoo have each strengthened their email authentication requirements. Emails sent from domains without proper DMARC/SPF/DKIM configuration are increasingly being routed to spam folders or bounced outright — “the grace period is over.” The core design philosophy of this tool is to allow any user, without needing external consultants, to gradually move from p=none (monitoring mode) up to the strictest enforcement policy of p=reject (full rejection). Cloudflare said it will continue to deepen forensic report detail, enhance smart recommendation capabilities, and strengthen integration with other products in the Cloudflare platform.